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A  Machine  Program  for  Theorem-Proving 
Martin  Davis,  George  Loganann,  and  Donald  Loveland. 

In  [1]  is  set  forth  an  algorithm  for  proving  theorems  of 
quantification  theory  x-jhich  is  an  improvement  in  certain,  respects 
over  previously  available  algorithms  such  as  that  of  [2],   The 
present  paper  deals  vith  the  programming  of  the  algorithm  of  [1] 
for  the  New  York  University,  Institute  of  Mathematical  Sciences* 
IBM  Toll  computer,  with  some  modifications  in  the  algorithm  sug- 
gested by  this  work,  with  the  results  obtained  using  the  completed 
algorithm.   Familiarity  with  [1]  is  assumed  throughout, 

1.   Changes  in  the  al.^orithm  and  r)ro.g;ramminp:  techniques 
used. 

The  algorithm  of  [1]  consists  of  two  interlocking  parts. 
The  first  part,  called  the  OJFL-   Generator,  generates  (from  the 
formula  whose  proof  is  being  attempted)  a  growing  prepositional 
calculus  formula  in  conjunctive  normal  form,  the  "quantifier-free 
lines."  The  second  part,  the  Processor,  tests,  at  regular  stages 
in  its  "growth,"  the  consistency  of  this  prepositional  calculus 
formula.  An  Inconsistent  set  of  quantifier-free  lines  constitutes 
a  proof  of  the  original  formula. 

The  algorithm  of  [1]  used  in  testing  for  consistency  proceeded 
by  successive  elimination  of  atomic  formulas,  first  eliminating 
one-literal  clauses  (one-literal  clause  rule),  and  then  atomic 
formulas  all  of  whose  occurrences  were  positive  or  all  of  whose 
occurrences  were  negative  (aff irmptive-negative  rule).   Finally, 
the  remaining  atomic  formulas  were  to  have  been  eliminated  by 
the  rule: 

III.   Rule  for  Eliminating  Atomic  Formulas.  Let  the  given 
formula  F  be  put  into  the  form  (A  V  p)  (^  (B  V  p)  ^R  vjhere  A,  B, 
and  R  are  free  of  p.  (This  can  be  done  simply  by  grouping 
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together  the  clauses  contrinlng  p  and  "factoring  out"  occurrences 
of  p  to  obtain  A,  grouping  the  clauses  containing  p  and  "factoring 
out"  p  to  obtain  B,  and  grouping  the  remaining  clauses  to  obtain 
R.)   Then  P  is  inconsistent  if  and  only  if  (A  V  B)  h^R   is  incons- 
istent. 

After  prograimiing  the  algorithm  using  this  form  of  Rule  III, 
it  x-jas  decided  to  replace  it  by  the  following  rule: 

III".  Splitting  Rule,  Let  the  given  formula  P  be  put  in 
the  form  (A  V  p )  "^^  (B  V  p)  A  R  where  A,B,  and  R  are  free  of  p. 
Then  F  is  inconsistent  if  and  only  if  A  ^  R  and  B  L  R  are  both 
inconsistent. 

Justification  of  Rule  III""".  Por"^  P=0,  P  =  A'\/R;  for 
p  =  1,   P  =  B  i   R. 

The  forms  of  Rule  III  are  interchangeable;  although  theoret- 
ically they  are  equivalent,  in  actual  applications  each  has 
certain  desirable  features*   ^-e  used  Rule  III"  because  of  the 
fact  that  Rule  III  can  easily  increase  the  number  and  the  lengths 
of  the  clauses  in  the  expression  rather  quickly  after  several 
applications.  This  is  prohibitive  in  a  computer  if  ones  fast 
access  storage  is  limited.  Also,  it  was  observed  that  after 
performing  Rule  III,  many  duplicated  and  thus  redundant  clauses 
were  present.   Some  success  was  h^d  by  causing  the  machine  to 
systematically  eliminate  the  rediAndancy;  but  the  problem  of  total 
length  increasing  rapidly  still  remained  when  more  complicated 
problems  were  attempted.  Also  use  of  Rule  III  C9n  seldom  yield 
new  one-literal  clauses,  whereas  use  of  Rule  III  '  often  will,. 

In  programming  Rule  III",  we  used  auxiliary  tape  storage. 
The  rest  of  the  testing  for  consistency  is  carried  out  using  only 
fast  access  storage.   iTaen  the  "Splitting  Rule"  is  used  one  of  the 
two  formulas  resulting  is  placed  on  tape.   Tape  memory  records 
are  organized  in  the  cafeterial  stack-of-plates  scheme:  the  last 
record  x^jritten  is  the  first  to  be  read. 
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In  the  program  written  for  the  IBM  70I4.,  the  matrix  and 
conjunction  of  quantifier-free  lines  are  coded  into  cross-ref- 
erenced associated  (or  linked)  memory  tables  by  the  QpL-Generator 
and  then  analyzed  by  the  Processor.   In  particular,  the  QPL- 
Generator  is  programmed  to  read  in  the  matrix  M  In  suitably 
coded  Polish  (i.e.,  "parenthesis-free")  form.   The  conversion  to 
a  quantifier-free  matrix  in  conjunctive  normal  form  requires, 
of  course,  a  certain  amoiont  of  pencil  work  on  the  formula,  which 
could  have  been  done  by  the  computer.   In  doing  this,  we  departed 
from  [1],  by  not  using  prenex  normal  form.  The  steps  are  : 

(1)  Write  all  truth-functional  connectives  in  terms  of '»-'  , 


^,  V. 


(2)  Move  all  "^^  s  inward  successively  (using  de  Morgan 


laws)  until  they  either  are.  cancelled  (with  another  ^-^  )   or 
acting  on  an  atomic  formula. 

(3)  Now,  replace  existential  quantifiers  by  function  symbols 
(cf.  [1],  p.  205),  drop  universal  quantifiers,  and  placje  in 
conjunctive  normal  form.  A  simple  one-to-one  assembler  was  writ- 
ten to  perform  the  final  translation  of  the  matrix  M  into  octal 
numbers. 

It  will  be  recalled  that  the  generation  of  quantifier-free 
lines  is  accomplished  by  successi.ve  substitutions  of  "constants" 

for  the  variables  in*  the  matrix  M,   In  the  program  the  constants 

are  represented  by  the  successive  positive  Integers. 

For  a  m-'^trix  containing  n  individual  variables,  the  n-tuples 

of  positive  integers  are  generated  in  a  sequence  of  increasing 

norm  such  that  all  n-tuples  ^'ith  a  given  norm  are  in  decreasing 

n-ary  numerical  order..  Here  we  define  the  norm  of  (j,,....,  j  )  = 

j,  +  . . .  +  j  =  II  j.,  II  •   Other  norms  could  have  been  used. 
1  n      1 

For  example.,  Gilmore  [2]  takes  for  1 1  j^^  1 1 ,  the  maximum  of 

j-,  ,  •••,    j  •   In  [1]  more  complicated  norm  is  indicated. 

Substitutions  of  successive  n-tuples  into  the  matrix  cause 
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new  constants  to  appear  in  the  matrix.   The  program  numbers 
constants  in  their  order  of  appearance.   Thus,  the  constants  are 
ordered  by  the  program  in  a  laanner  depending  upon  the  input  data. 
By  rearranging  the  clauses  of  a  formula  a  different  order  would 
in  general  be  created.   In  some  cases,  whether  or  not  the  program 
could  actually  prove  the  validity  of  a  given  formula  (without 
rionning  out  of  fast  access  stor?2e)  depended  on  how  one  shuffled 
the  punched-data  deck  before  reading  it  into  the  assembler  I 
Thus,  the  variation  in  ordering  of  constants  did  affect  by  a 
factor  of  10  (from  500  to  5000)  the  number  of  lines  needed  to 
prove   the  validity  of  : 

(e)(Ed)(x)(y)[S(x,y,d)  — >  T(x,y,e)] 

— >  (e)(x)(Ed)(y)[S(x,y,d)  —>  T(x,y,e)] 

(This  valid  formula  may  be  thought  of  as  asserting  that  loniform 
continuity  implies  continuity  if  we  set: 

S(x,y,d)  <  ->  |x  -  y I  <  d 

T(x,y,e)  <^>      |f(x)  -  f (y)  |  <  e.) 

In  storing  the  qu.antifier-free  lines,  two  tables  are  used. 
The  fiist,  called  the  oonjunctjjon  t abXe_,  is  a  literal  image  of 
the  quantifier-free  lines  in  'hich  one  machine  word  corresponds 
to  one  literal,  i.e.  to  p  or  -"^p  where  p  is  an  atomic  formula. 
The  lines  in  the  second,  or  formula  table  are  themselves  heads 
of  two  chain  lists  giving  the  occurrences  of  p  and  ''^p  respec- 
tively in  the  con.iionction  table.   In  addition,  included  for 
formula  p  in  the  formul"  table  are  counts  of  the  number  of  clauses 
in  x-hich  p  and  '^  p  occur  and  total  number  of  all  literals  in 
these  clauses;  the  formula  table  is  Itself  a  two-way  linked  list. 
A  third  short  list  of  those  literals  is  kept  in  which  are   enter- 
ed all  formulas  to  T,hich  the  one-lateral  clause  and  affirmative- 
negative  rules  apply;  this  is  called  the  ready  list* 
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If  the  program  tries  to  enter  p  and  ^-vyp  into  the  ready  list, 
an  inconsistency  has  been  found;  the  machine  stops. 

The  totality  of  the  processing  rules  requires  only  two 
basic  operations:  a   subroutine  to  delete  the  occurrences  of  a 
literal  p  or  ^v-^p  from  the  quantifier-free  lines,  and  a  routine 
to  eliminate  from  them  all  the  clauses  in  which  p  or '->^p  occur. 

^•fe  may  observe  that  only  the  deletion  prograra  can  create 
new  one-literal  clauses,  and  likewise  applications  of  the  affirm- 
ative-negative rule  can  come  only  from  the  elimination  program. 

The  machine  thus  performs  the  one  literal-clause  and  affirm- 
ative-negative rules  as  directed  by  the  ready  list  until  the 
ready  list  is  empty.   It  is  possible  that  the  choice  of  p 
to  be  eliminated  first  is  quite  critical  in  determining  the  length 
of  computation  required  to  reach  a  conclusion:  a  program  to  choose 
p  is  used,  but  no  tests  were  made  to  vary  this  segment  of  the 
program  beyond  a  random  selection,  namely  the  first  entry  in  the 
formula  table.   To  perform  Rule  III",  one  saves  the  appropriate 
tables  with  some  added  reference  information  in  a  tape  record, 
then  performs  an  elimination  on  'v^  p  and  a  deletion  on  p.  At 
a  consequent  discovery  of  consistency,  one  must  generate  more 
quantifier  free  lines;  the  ^JPL-generator  is  recalled.   Otherwise, 
at  finding  an  inconsistency,  the  machine  must  check  to  see  if 
there  are  any  records  on  the  Rule  III"  tape:  if  none,  the 
quantifier-free  lines  were  inconsistent;  otherwise,  it  reads  in 
the  last  record. 

If  one  uses  Rule  III,  (which  we  did  in  an  early  version  of 
our  program)  an  entirely  different  code  is  needed.  The  problem 
is  precisely  that  of  mechanizing  the  application  of  the  distrib- 
utive law. 

2.  Results  obtained  in  running  the  program. 

At  the  time  the  programraing  of  the  algorithm  was  undertaken, 
we  hoped  that  some  mathematically  meaningful  and,  perhaps  non- 
trivial,  theorems  could  be  proved.   The  actual  achievements  in 
this  direction  were  somewhat  disappointing.   However,  the  program 


orix.j.  '  ' 

q  lo  eotoiL    ■  ■    :^I':i'?" 


*>T 


,.,,--    ,L, 


e  -  ■  ■.'   fix  ■ ;  1 1  ne   ^  5  r. ' 
sctjGXicoiqqjB   © 


lO   ".'■•i' 


Q<;    'vt 


•  ;.'.ncc'  B 


me  Id  O'tq  or' 


<?,  f     iJCst 


i,B/-r     <r.'^- 


•  ^  ^** '-     j^ 


KJ.fl'JgOlC 


,  xev 


.it  :*£■:. 


6 

performed  as  veil  as  expected  on   the  simple  predicate  calculus 
formulas  offered  as  fare  for  a  previous  proof  procedure  program, 
(See  Gilmore  [1].)   In  particulnr,  the  well-formed  formula 
(Ex)(Ey)(z)  ip(x,y)— >  (F(y,z)  ^  F(z,z)))  §((P(x,y)  ^G(x,y)) 

— >  (G(x,z)  ^G(z,z)))J 
vjhich  was  beyond  the  scope  of  Gilmore' s  program  was  proved  in 
under  two  minutes  with  the  present  program.   Gilmore 's  program 
was  halted  at  the  end  of  7  "substitutions",  (quantifier-free  lines) 
after  an  elapsed  period  of  about  21  minutes.   It  was  necessary  for 

the  present  program  to  generate  approximately  60  quantifier-free 

2 
lines  before  the  inconsistency  appeared.    Indeed,  the  "uniform 

continuity  implies  continuity"  example  mentioned  above  required 
over  500  quantifier-free  lines  to  be  generated  and  was  shown 
to  be  valid  in  just  over  two  minutes.   This  was  accomplished  by 
nearly  filling  the  machine  to  capacity  with  generated  quantifier- 
free  lines  (2000  lines  in  this  case)  before  applying  any  of  the 
rules  of  reduction  • 

Rather  than  describe  further  successes  of  the  program,  it 
vjill  be  instructive  to  consider  in  detail  a  theorem  that  the 
program  was  incapable  of  proving  and  to  examine  the  cause  for 
this.  This  particular  example  is  one  the  authors  originally  had 
hoped  the  program  could  prove,  an  elementary  group  theory  problem. 
In  essence,  it  is  to  shoxj  that  in  a  group  a  left  inverse  is  also 
a  right  inverse. 

It  is,  in  fact,  quite  easy  to  follow  the  behavior  of  the 
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proof  procedure  on  this  particular  example  r\3   it  parallels  the 

usual  approach  to  the  problera.  The  problem  may  be  formulated 
as  follows  : 

Axioms :     1.  e  •  x  =  x 

2,  I(x)  •  X  =  e 

3.  (x*y)  •  z  =  w  =>  X.  (yez)  =  w 
I4-.  x«(y«z)  =  w  =>  (x»y)  ,  z  =  w 

Conclusion  :  x  •  I(x)  =  e 

The  letter  _e  is  Interpreted  as  the  identity  element  and  the 
function  I  as  the  inverse  function.   The  associative  lai,j  has 
been  split  into  two  clauses  for  convenience. 

A  proof  is  as  folloTTs  : 

1.   KKx))  •  I(x)  =  e         by  Axiom  2 

2,e«x=x  by  Axiom  1 

3.   I(x)  .  X  =  e  '  'by  Axiom  2  •  . 

1+.   I(I(x))  ,  e  =  X    ■  ■    '  '  by  Axiom  3,   taking  (I(  I(x) ), 

I(x),x)  for  (x,y,z) 

5«   e  .  I(x)  =  I(x)    .        by  Axiom  1 

6.  I(I(x))  .  I(x)  =  e         by  Axiom  2 

7.  I(I(x))  .  e  =  X  step  I). 

8.  x  .  I(x)  =  e         .,    by  Axiom  k,    taking  (I(I(x)), 

e,I(x))  for  (x,y,z) 
Step  8.  is  the  desired  result. 

To  formalize  this  proof  would  require  adjoining  axioms 

of  equality.   To  avoid  this,  one  can  introduce  the  predicate  of 
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three  arguinents  ?{x,j,z) ,    interpreted  as  x  •  y  =  z.   The  theorem 
reformulated  becomes 
Axioms:     1.   P(e,x,x) 

2.  P(I(x),x,e) 

3.  -^P(x,y,u)   y^P(u,z,w)  V  — P(y,2,v)  V  P(x,v,w) 
k.    ^P(y,z,v)   V'-P(x,v,w)\/  ^P(x,y,u)  V  P(u,z,w) 

Conclusion  :   P(x,I(x),e). 

The  theorem  to  be  proved  valid  is  the  implication  of  the 
conjunction  of  the  four  axioms  vjith  the  conclusion,  the  univers- 
al quantifiers  appearing  outside  the  matrix. 

To  complete  the  preparation  of  the  veil -formed  formula 
for  encoding  for  the  assembler,  it  is  necessary  to  negate  the 
conclusion,  (cf.  [1],  p.  20li)« 

The  single  existential  quantifier  has  no  dependence  on  the 
universal  quantifiers,  hence  leads  to  the  constant  ftinctlon  _s 
T'hen  this  existential  quantifier  is  replaced  by  a  function  symbol. 
(cf.  [1],  p.  205.) 

The  conclusion  then  becomes 
-^PCs,  I(s),  e)  , 
The  conjunction  of  this  i.tith  the  I),  axioms  gives  the  desired  form. 

As  seen  from  the  proof  previously  noted  the  quantifier-free 
clauses  needed  to  produce  the  inconsistency  are 

1.  P(I(I(s)),  I(s),e) 

2.  P(e,s,s) 

3.  P(I(s),s,e) 
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I|.  -x.PdCKs)),  I(s),  e)  v^P(e,s,s)v  -v^  P(  I(  s),s,e)v  P(I(I(s)),e, 

3) 

5.  P(e,I(s),I(s)) 

6.  ^P(e,I(s),  I(s))vA.P(I(I(s)),  I(s),  e)v^P(I(I(s),e,s)v 

P(s,  I(s),6) 

7.  ^P(s,  I(s),e) 

(It  is  quite  clear  in  this  case  that  successive  applications 
of  the  one-literal  clause  rule  reduce  this  set  to« 

P(s,  Ks),  e)(6  -^P(s,  I(s),e).) 

The  question  to  be  considered  is:  how  many  quantifier-free 
lines  must  be  generated  by  the  present  program  to  realize  these 
required  lines?   The  constants  are  generated  in  the  following 
order: 
1,   e 
2»   s 
3.   Ks) 
1|.    Ke) 
5.   KKs)) 

OtC« 

(The  constants  are  identified  directly  mth  their  index 
e.g.  the  6-tuple  (1,1,1,1,1,1)  represents  (e,e,e,e,e,e) .  As 
this  is  the  first  substitution,  the  program  assigns  in  order, 
reading  the  veil-formed  formula  backTA^ards  and  from  the  inside 
out  for  nested  fimctions;  e,s,I(s),  1(e),  I(I(s)).   The  I(I(s)) 
appears  when  x  is  assigned  I(s),  no  nex-j  entries  occurring  until 
this  time.  Note  that  there  are  6  free  variables  (u,v,w,x,y,z) 
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10 
in  the  matrix) . 

The  program  generates  the  needed  n-tuples  by  producing  all 
possible  n-tuples  of  integers  x-jhose  sum  W  of  entries  is  fixed, 
N=n,   n+1,....   Thus  it  is  only  necessary  to  consider  the  n-tuple 
which  has  the  maximum  sura  of  entries.   In  this  case,  the  substitu- 
tion u  =  s,  V  =  I(s),  w  =  e,  X  =  KKs)),  y  =  e,  z  =  I(s)  (required 
for  axiom  k   to  produce  the  clause  6  in  the  "proof"  above  in  a 
quantifier-free  line)  gives  the  n-tuple  with  maximuin  sum.   The 


n-tuple  is  seen  to  be  (2,3,1,5,1>3 ) ,  the  sum  equals  l5»   The 
combinatorial  expression  [    )  gives  the  totol  number  of  n-tuples 
of  positive  integers  whose  sum  is  less  then  or  equal  to  N« 

It  is  seen  that  to  prove  this  theorem  at  least  (  /^  /  ~  3003 

lines  must  be  generated  and  that  the  inconsistency  will  be  found 
on  or  before  \  ^  )  -  5005  lines  have  been  generated.^ 

The  present  program  generated  approximately  130O  quantifier 
free  lines.   This  number  of  quantifier-free  lines  was  accomplished 
holding  all  major  table s^-  simultaneously  in  core  memory,  limited 
to  32,768  "words".   (This  was  done  to  insure  a  reasonable  time 
factor  for  any  problem  within  possible  scope  of  the  program. 

For  this  reason  also,  the  entire  program  was  coded  in  SAP 
with  many  time-saving  devices  employed.) 

The  authors  feel  that  a  reprogramming  to  make  use  of  tape 
storage  of  tables   might  realize  a  factor  of  U  for  the  total 
number  of  quantifier-free  lines  attainable  before  running  time 
became  prohibitive.   This  would  be  just  sufficient  for  this 
problem.   That  realizing  this  extra  capacity  is  really  uninter- 
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esting  is  seen  by  noting  that  if  the  conclusion  was  placed 
before  the  axioms,  altering  the  validity  of  the  matrix  not  at 
all,  the  element  1(e)  would  be  generated  before  I(s)  and  the 
needed  n-tuple  would  sum  to  16,   Then  (  2  )  ="  8008  becomes  the 
upper  bound,  beyond  the  capacity  of  the  projected  program. 
Other  formulations  of  the  same  problem  result  in  quite  unapproach- 
able figures  for  the  number  of  quantifier-free  lines  needed. 
(For  another  example  illustrating  the  same  situation,  see  Prawitz 

[3]). 

The  existing  program  allows  one  to  think  of  working  with  a 
capacity  of  1000  or  2000  quantifier-free  lines  instead  of  a  cap- 
acity of  10  or  20,  the  previous  limit.   The  time  required  to  gen- 
erate additional  quantifier-free  lines  is  independent  of  the 
number  of  quantifier-free  lines  already  existing.   Against  this 
linear  growth  of  number  of  quantifier-free  lines  generated,  there 
is,  in  a  meaningful  sense,  an  extreme  non-linear  growth  in  the 
number  of  quantifier-free  lines  to  be  considered  with  increasingly 
more  "difficult"  problems.   This  is  true  of  simple  enumeration 
schemes  of  the  nature  considered  Here.   It  seems  that  the  most 
fruitful  future  results  will  come  from  reducing  the  number  of 
quantifier-free  lines  that  need  be  considered,  by  excluding,  in 
some  sense,  "irrelevant"  quantifier-free  lines.  Some  investiga- 
tion in  this  area  has  already  been  done  (see  Prawitz  [3]). 
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Footnotes . 

■'■  As  in  [1],  1  stands  for  "truth",  and  0  for  "falsehood". 

2 

In  [1],  a  hand -calculation  of  this  example  using  the  present 

scheme  showed  inconsistency  at  25  quantifier-free  lines.   The 

discrepancy  is  due  to  a  different  rule  for  generation  of  constants, 

■^   To  see  this,  consider  a  sequence  of  R  +  1  ones.   Flag  n  of  these. 
The  flag  is  to  be  interpreted  "sum  all  I's,  including  the  flagged 
1,  to  the  next  flag  and  consider  this  sum  as  an  entry  in  the 
n-tuple".   Placing  an  luif lagged  1  on  the  extreme  left,  leaving  it 
fixed,  consider  the  possible  permutations  of  all  other  symbols. 
The  different  sequences  total  /   \  and,  regarding  the  set  of  I's 
starting  vith  the  last  flagged  1  as  overfloij,  this  is  seen  to 
represent  precisely  the  desired  n-tuples. 

^  If  the  rule  for  generating  n-tuples  had  been,  for  each  m,  to 
generate  all  n-tuples  possible  such  that  each  entry  assumes  a 
positive  integral  value  <  ra,  it  is  clear  that  at  least  I|.  =  [|.096 
quantifier-free  lines  would  be  needed  and  5  =  15625  lines  would 
suffice  to  guarantee  a  solution.   If  no  more  information  were 
available,  one  sees  ^intuitive  adv^nt'age,  in  this  case,  for 
using  the  previous  method.   In  general,  the  authors  see  no  pref- 
erence for  either  method,  in  contrast  to  some  previous  sugges- 
tions that  the  latter  method  seemed  intuitively  better. 
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